Analysis

  • max time kernel
    132s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-01-2024 03:37

General

  • Target

    Uninstall.exe

  • Size

    44KB

  • MD5

    c30a8655799cdcf83ff2ac51af7da1f7

  • SHA1

    f1a817a066e8f6e1c5472d484c9a38e54a1c348e

  • SHA256

    d0bdf661871582c8086e5c753ba4d4d725371e3a5612a377cb41f2d144189594

  • SHA512

    b13a422c7eff9b7bd4b391b854735317143ba321cb40a155df05dc2240f9653eeca67dd230117f606baad0832066073926030d4168f6f4d658ab347fde0aa33d

  • SSDEEP

    768:9VSO0QdGLkD8HYayXJMIBImhiPbvu9/vHtLE8JGlzIvGmUgmoAql3/3:90mrcYRiiVhOuc8JmIhmoAqlv3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • NSIS installer 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
    "C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe
      "C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      PID:4048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe

    Filesize

    44KB

    MD5

    c30a8655799cdcf83ff2ac51af7da1f7

    SHA1

    f1a817a066e8f6e1c5472d484c9a38e54a1c348e

    SHA256

    d0bdf661871582c8086e5c753ba4d4d725371e3a5612a377cb41f2d144189594

    SHA512

    b13a422c7eff9b7bd4b391b854735317143ba321cb40a155df05dc2240f9653eeca67dd230117f606baad0832066073926030d4168f6f4d658ab347fde0aa33d